Joint Letter to FHA on Cybersecurity Incident Reporting Requirements

Dear Ms. Gordon,

The American Bankers Association, Bank Policy Institute, and the Housing Policy Council (collectively, the Associations) write to provide feedback on the Federal Housing Administration's (FHA) Mortgagee Letter 2024-10 establishing cyber incident reporting requirements for FHA-approved mortgagees. The Mortgagee Letter, effective immediately, contains wide-ranging and rapid requirements for cyber incident reporting that are simply not achievable and will present considerable compliance challenges for FHA-approved mortgagees. Therefore, the Associations request that FHA withdraw the current Mortgagee Letter and reconsider the terms set forth. An immediate suspension would allow the agency additional time to consider other existing cyber regulatory reporting requirements and to develop an approach that satisfies FHA's goals without introducing unique new standards that will create adverse operational impacts for firms and customers during the critical stages of incident response.

As currently drafted, the Mortgagee Letter has an impractical "significant cybersecurity incident" definition, combined with an insufficient reporting timeframe. The definition covers events that "potentially jeopardize" information or information systems or pose an "imminent threat of violation" to security policies, both ambiguous standards to meet. On top of that, FHA-approved mortgagees must report incidents "within 12 hours of detection" which is extraordinarily challenging in part due to dependence on reporting from third party service providers. Taken together, those thresholds for reporting extend beyond any existing Federal or state reporting requirement.

The breadth and speed of the Mortgagee Letter's current requirements are also inconsistent with several ongoing government cyber regulatory harmonization efforts. This includes the Cyber Incident Reporting Council's ("CIRC") work to coordinate, deconflict, and harmonize Federal incident reporting requirements. Moreover, the requirements are at odds with the National Cybersecurity Strategy's objective "to harmonize not only regulations and rules, but also assessments and audits of regulated entities" to "minimize the burden of unique requirements."

As last year’s CIRC report identified, there are at least eight separate incident reporting requirements applicable to financial institutions. Among others, these include the prudential banking regulators’ Computer-Security Incident Notification Rule and the Cyber Incident Reporting for Critical Infrastructure Act. Introducing a new requirement with a distinct threshold and timeframe for reporting threatens to further complicate an already complex regulatory landscape. In fact, according to a recent survey of large financial institutions, firm cyber teams now spend as much as 70 percent of their time on regulatory compliance matters. Therefore, an uncoordinated approach to regulatory reporting requirements is not without consequence and leaves cyber professionals with less time for the core security activities that are essential to effectively managing the organization’s cyber risk.

The Associations are committed to working with FHA to better understand the intent behind the Mortgagee Letter and explore ways to accomplish those goals without diverting critical incident response resources. If you have any questions or would like to discuss these comments further, please contact Heather Hogsett at [email protected], John Carlson at [email protected], or Meg Burns at [email protected].

Sincerely,

Heather Hogsett
SVP, Technology & Risk Strategy, BITS
Bank Policy Institute

John Carlson
VP, Cybersecurity Regulation & Resilience
American Bankers Association

Meg Burns
Executive Vice President
Housing Policy Council